Investigating the Suspect Computer
Is there a PKZip-encryption cracker online for the following program which claims to offer a link to a couple of dozen shareware password crackers of popular programs? The exe-file is easily downloaded. There's a copy for testing for privacy protection: http://jya.com/pci-pack.exe (20K) Investigating the Suspect Computer PC Data Recovery for the Criminal Investigator Law Enforcement Use Only http//www.forensicdynamics.com/pccrime.htm WHAT EXACTLY, DOES THE SOFTWARE DO ? The software is designed to almost completely automate the formidable task of extracting forensic data from today's modern personal computers with large or multiple hard drives. The program automatically examines startup files for "booby traps", and searches the entire machine for "bomb" programs which, if triggered, could destroy valuable evidence on the machine. PC-Investigator runs exclusively from diskette, at the DOS level, and does NOT perform any write operations to the hard drive. This insures that fragile data, or files that may be evidence which have been deleted, or are resident in "slack space", are not inadvertently overwritten. A unique feature of the software is the ability to construct custom-tailored reports. The catalog function extracts and organizes all the files on the hard drive, and sorts them into order by type, date and time, according to directory. During this process, all the readable (text) files are extracted into a separate list, and are organized by type in the report. Also available is an extracted report listing of graphic (picture) files, and files that are typically used on the Internet, along with an extracted list of word processor files, backup files, ASCII text, and files that are recovered by CHKDSK or SCANDISK, which are commonly overlooked as a source of forensic evidence. PC-Investigator has unique features that duplicate the manual functions normally performed during such forensic investigations. The most valuable feature is the ability to search all the files on the disk for the presence of up to 600 words or phrases called HotWords, that you supply in an editable file. This function is the equivalent of the manual process of "Find Files and Folders" / "Files Containing" under Windows 95 , which typically takes 30 seconds to 3 minutes to do manually for each word or phrase you are looking for. The function is performed using words and phrases from the HotWord list, hundreds of times per second. A typical 2 Gigabyte hard drive may contain over 500 readable text files. A manual search for the occurrence of a single word or phrase occurring in those files typically takes 90 seconds. If you had to search for those 200 words manually, the time required would be 5 hours at the keyboard. The HotWord search feature of PC- Investigator performs this function on a 486/50 machine in just under 45 minutes. If the number of files to be searched is substantially higher, such as on today's large hard drives (typically 2 to 4 Gigabytes, with 12 Gigabyte drives available on top-end systems) the time required to perform an exhaustive search would be proportionately higher (500 to 1,000 man-hours). PC-Investigator completely searches a 2 Gigabyte drive n a 486/120 machine in just under 24 hours. The faster the processor, and hard disk controller, the faster the program will run to completion. The best part is that each file containing any of the words or phrases in your list is cataloged in the report, along with the number of "hits" or HotWords found in the file. After the program is started, and the desired options are selected, the program will run un-attended, doing the work that would normally not be done in such cases because of the tremendous amount of time and effort involved. Of course, files which do not contain "clear text", or are DES or BLOWFISH / PGP encrypted will not be flagged by the program. However, we have software which addresses the problem of APPLICATION encryption - that is - files which are encrypted by the application which created them. For example, LOTUS 123, Quick Books, PFS Professional, and WordPerfect are among the few programs which offer in-application encryption of files. The program does NOT extract or examine the data from "slack space". However, running the program is easy, and can be done by almost anyone with a bit of computer skills. The software is designed as a preliminary investigative tool, to determine if a machine should be examined by a professional. If this program indicates a "HOT" machine, you can be certain that a more extensive investigation is warranted. ----- PCI-PACK.EXE Includes PC-Investigator software, manual and Investigating The Suspect Computer THIS PACKAGE IS DISTRIBUTED TO LAW ENFORCEMENT AND PRIVATE INVESTIGATORS ONLY!! THE ARCHIVE FILE IS [PKZip] ENCRYPTED, AND YOU WILL NEED A PASSWORD TO EXTRACT THE ARCHIVE. IF YOU ARE NOT WORKING IN LAW ENFORCEMENT, DON'T BOTHER TO DOWNLOAD THE FILE, WE WILL NOT DISTRIBUTE THE PASSWORD UNLESS WE CAN VERIFY YOUR CREDENTIALS.
THIS PACKAGE IS DISTRIBUTED TO LAW ENFORCEMENT AND PRIVATE INVESTIGATORS ONLY!! THE ARCHIVE FILE IS [PKZip] ENCRYPTED, AND YOU WILL NEED A PASSWORD TO EXTRACT THE ARCHIVE. IF YOU ARE NOT WORKING IN LAW ENFORCEMENT, DON'T BOTHER TO DOWNLOAD THE FILE, WE WILL NOT DISTRIBUTE THE PASSWORD UNLESS WE CAN VERIFY YOUR CREDENTIALS.
6161234432565677 possibilities for up to 8 printable-characters (roughly 2^52) 217180147133 poss. for up to 8 lowercase letters (roughly 2^38) 54507958502609 poss. for up to 8 lower/upper letters (roughly 2^46) 221919451578029 poss. for up to 8 alphanumeric chars. (roughly 2^48) Apparently, the password can be up to 80 printable characters in length... 715934338421370680344382998236434541670979942120825502830105586745112050\ 939906381266091474511676185877408805164512571770773165479768270778933665\ 90119714237357 possibilities worst-case (roughly 2^524) According to one of the READMEs that comes with a public domain implementation of the PKZIP crypto algorithm, there is a known-plaintext attack against it described at http://www.cryptography.com/. If it's 8 or less lower-case letters, it would seem that it's probably crackable in a reasonable amount of time on a high-end desktop PC or workstation. Anything more would probably require a distributed attack. -- Brian Buchanan brian@smarter.than.nu Never believe that you know the whole story.
Brian W. Buchanan wrote:
THIS PACKAGE IS DISTRIBUTED TO LAW ENFORCEMENT AND PRIVATE INVESTIGATORS ONLY!! THE ARCHIVE FILE IS [PKZip] ENCRYPTED, AND YOU WILL NEED A PASSWORD TO EXTRACT THE ARCHIVE. IF YOU ARE NOT WORKING IN LAW ENFORCEMENT,
According to one of the READMEs that comes with a public domain implementation of the PKZIP crypto algorithm, there is a
A few years ago the plaintext attack was implmented. One of the first tests was on an encrypted file released in Europe that was supposed to contain the source code and emulation of the Sky 0A smartcard. It cracked it in about 3 hours I seem to recall. The implementation worked exceedingly well and ran on Linux. The page says that the w95 version is also available. http://www.unix-ag.uni-kl.de/~conrad/krypto/pkcrack.html Regards...jmcc -- ******************************************** John McCormac * Hack Watch News jmcc@hackwatch.com * 22 Viewmount, Voice: +353-51-873640 * Waterford, BBS&Fax: +353-51-850143 * Ireland http://www.hackwatch.com/~kooltek ******************************************** -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAzAYPNsAAAEEAPGTHaNyitUTNAwF8BU6mF5PcbLQXdeuHf3xT6UOL+/Od+z+ ZOCAx8Ka9LJBjuQYw8hlqvTV5kceLlrP2HPqmk7YPOw1fQWlpTJof+ZMCxEVd1Qz TRet2vS/kiRQRYvKOaxoJhqIzUr1g3ovBnIdpKeo4KKULz9XKuxCgZsuLKkVAAUX tCJKb2huIE1jQ29ybWFjIDxqbWNjQGhhY2t3YXRjaC5jb20+tBJqbWNjQGhhY2t3 YXRjaC5jb20= =sTfy -----END PGP PUBLIC KEY BLOCK-----
There's a batch of PKZip and other program cracker tools at: http://www.theargon.com/tools.html With links to other sites, which link to more, into the dark psychoses of Trans-Ural and Andean regions -- some of the DNS's are off the charts. Even so, none seem to work on the pci-pack.exe I grabbed, at least not for me. The file may not be complete, or it's a decoy, or all the vile crackers I unzipped are DIRT-virii death-writhing in my unzapped prostate.
participants (3)
-
Brian W. Buchanan
-
John McCormac
-
John Young